Spring Boot Management security works differently with port set

Question

I'm trying to configure a Spring Boot application (1.2.3, but this also fails with the 1.2.4.BUILD-SNAPSHOT version) with Actuator support. I want to use the Actuator security config for controlling access to the management endpoints, and our own authentication for the rest of the application.

Here is my security config:

@Configuration
@EnableWebSecurity
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{

    @Autowired
    private CustomAuthenticationProvider customAuthProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception
    {
        auth.authenticationProvider(customAuthProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http
            .authorizeRequests()
            .regexMatchers(API_DOC_REGEX).permitAll()
            .regexMatchers(String.format(PATH_REGEX, PUBLIC_ACCESS)).permitAll()
            .regexMatchers(String.format(PATH_REGEX, INTERNAL_ACCESS)).access("isAuthenticated() && authentication.hasOrigin('INTERNAL')")
            .regexMatchers(String.format(PATH_REGEX, EXTERNAL_AUTHENTICATED_ACCESS)).authenticated()
            .antMatchers("/**").denyAll()
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
            .and()
            .addFilterAfter(customAuthProcessingFilter(), BasicAuthenticationFilter.class)
            .csrf().disable();
    }

}

This works correctly when I don't set a management port, but when I set the management port, the management URLs return 401 responses. If I comment out the line .antMatchers("/**").denyAll(), then everything goes through without requiring authentication at all. So it looks like it is using my application's security config for the Actuator endpoints when I set a custom port, but I'm not sure why.

How do I get it to use it's own security when running on a custom port?

Add another WebSecurityConfigurerAdapter which has @Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER) as explained in here — M. Deinum
It looks like that is what I'm doing? The docs say The Actuator security features can be modified using external properties (management.security.*). To override the application access rules add a @Bean of type WebSecurityConfigurerAdapter and use @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) if you don’t want to override the actuator access rules, or @Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER) if you do want to override the actuator access rules. — Spencer Uresk
No you are configuration the general application rules not the management rules. — M. Deinum

Spencer Uresk Spencer Uresk · Accepted Answer · 2015-04-30T21:14:31

Expanding on the comment from @M. Deinum, adding another adapter for the Management stuff (even though it already has one) seems to have fixed it. This is the class I ended up with:

@Order(0)
@Configuration
public class ManagementSecurityConfig extends WebSecurityConfigurerAdapter
{

    @Autowired
    ManagementServerProperties managementProperties;

    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http
                .requestMatchers()
                .requestMatchers(new RequestMatcher()
                {

                    @Override
                    public boolean matches(HttpServletRequest request)
                    {
                        return managementProperties.getContextPath().equals(request.getContextPath());
                    }
                })
                .and()
                .authorizeRequests()
                .anyRequest().hasRole("ADMIN")
                .and()
                .httpBasic();
    }
}

Spring Boot Management security works differently with port set

1 Answers